v0.29.0

src/proxy/redirect_helpers.rs

@@ -0,0 +1,66 @@
+// Frontend redirect helpers.
+/// Build a same-host HTTPS redirect while preserving the request path and query.
+fn force_ssl_location(host: &str, uri: &Uri, port: u16) -> Option<HeaderValue> {
+    let path = uri
+        .path_and_query()
+        .map(|value| value.as_str())
+        .unwrap_or("/");
+    let location = if port == 443 {
+        format!("https://{host}{path}")
+    } else {
+        format!("https://{host}:{port}{path}")
+    };
+    HeaderValue::from_str(&location).ok()
+}
+
+fn canonical_host_redirect(
+    frontend: &crate::config::CompiledFrontend,
+    host: &str,
+    tls: bool,
+    local_port: u16,
+    uri: &Uri,
+) -> Option<Response> {
+    let (from, to) = frontend.www_redirect.as_ref()?;
+    if !host.eq_ignore_ascii_case(from) {
+        return None;
+    }
+    let (scheme, port) = if tls {
+        ("https", local_port)
+    } else if frontend.force_ssl {
+        ("https", frontend.https_redirect_port?)
+    } else {
+        ("http", local_port)
+    };
+    let path = uri.path_and_query().map(|value| value.as_str()).unwrap_or("/");
+    let default_port = (scheme == "https" && port == 443) || (scheme == "http" && port == 80);
+    let location = if default_port {
+        format!("{scheme}://{to}{path}")
+    } else {
+        format!("{scheme}://{to}:{port}{path}")
+    };
+    let mut response = StatusCode::PERMANENT_REDIRECT.into_response();
+    response.headers_mut().insert(http::header::LOCATION, HeaderValue::from_str(&location).ok()?);
+    response.headers_mut().insert("cache-control", HeaderValue::from_static("no-store"));
+    Some(response)
+}
+
+fn force_ssl_redirect(
+    frontend: &crate::config::CompiledFrontend,
+    host: &str,
+    uri: &Uri,
+) -> Option<Response> {
+    if !frontend.force_ssl {
+        return None;
+    }
+    let location = force_ssl_location(host, uri, frontend.https_redirect_port?)?;
+    let mut response = StatusCode::PERMANENT_REDIRECT.into_response();
+    response
+        .headers_mut()
+        .insert(http::header::LOCATION, location);
+    // Do not pin a redirect in a browser after an operator later disables Force SSL.
+    response
+        .headers_mut()
+        .insert("cache-control", HeaderValue::from_static("no-store"));
+    Some(response)
+}
+